Cross-source coverage

T1525 / ATT&CK

Implant Internal Image

5 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike Upload Malware, this technique focuses on adversaries implanting an image in a registry within a victim’s environment. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.

A tool has been developed to facilitate planting backdoors in cloud container images. If an adversary has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a Web Shell.

Tactics
Persistence
Platforms
IaaS · Containers
Telemetry
docker:daemondocker:registryAWS:CloudTrail

How MITRE says to detect it DET0334

Detection Strategy for T1525 – Implant Internal Image

Containers Analytic 0946

Implantation of malicious code into container images followed by registry push and use in new deployments.

  • docker:daemon docker build or docker commit commands followed by docker push to internal registry
  • docker:registry push event of new image version from unrecognized user or context

IaaS Analytic 0947

Creation or modification of cloud virtual machine images (AMIs, custom images) with persistence mechanisms, followed by infrastructure provisioning that uses these implanted images.

  • AWS:CloudTrail RegisterImage
  • AWS:CloudTrail ModifyImageAttribute
  • AWS:CloudTrail RunInstances

View on attack.mitre.org ↗

panther-labs/panther-analysis

3 rules
Detection Severity Format
Lambda CRUD Actions High Panther Python
Kubernetes Pod Created in System Namespace Medium Panther Python
ECR CRUD Actions Informational Panther Python

SigmaHQ/sigma

1 rule
Detection Severity Format
AWS ECS Task Definition That Queries The Credential Endpoint Medium Sigma

elastic/detection-rules

1 rule
Detection Severity Format
AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered Medium Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.